CVE-2026-97588
Received Received - Intake

s390 Crypto Key Conversion Failure Leads to Indefinite Blocking

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly When hardware persistently returns -EBUSY after exhausting retries, the error propagates to crypto_finalize_*_request(). The crypto API's completion wrapper treats -EBUSY as a queueing status and swallows it, preventing the completion callback from firing. This causes callers using crypto_wait_req() to block indefinitely. Translate persistent -EBUSY to -EIO after retry exhaustion to ensure proper error propagation and callback invocation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-10-15
AI Q&A
2026-09-25
EPSS Evaluated
2026-10-14
NVD
CVE-2026-97588
EUVD
EUVD-2026-86896

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Linux kernel's s390/crypto component. When hardware repeatedly returns an error (-EBUSY) during key conversion, the system fails to properly handle it. Instead of treating this as a final error, the crypto API incorrectly sees it as a temporary queueing status and ignores it. This prevents the completion callback from running, causing programs waiting for crypto operations to hang indefinitely.

Detection Guidance

This vulnerability affects the Linux kernel's s390/crypto subsystem and may cause indefinite blocking in crypto_wait_req(). Detection requires checking kernel logs for crypto API errors or timeouts related to key conversion failures. Monitor for -EBUSY errors persisting after retry exhaustion in s390 crypto operations.

Impact Analysis

If you use applications relying on the Linux kernel's crypto API on s390 systems, those applications may freeze or become unresponsive. This could disrupt services that depend on encryption or cryptographic operations, such as secure communications or data storage.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a low-level Linux kernel crypto subsystem error handling issue. No evidence suggests it impacts data protection, encryption integrity, or access controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the s390/crypto issue where -EBUSY is mapped to -EIO during key conversion failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97588. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart